Fair, but remember that we are the <~1% of people who even know what webusb is. I'm not sure I share your view on this.

Maybe an about:config switch to enable it would be enough to stop casuals from pwning their peripherals.